General
- Target 2026-11-07_ff2ea33709e08311c1d1fbe0e1c698f6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 456KB
- Sample261108-behynahs6j
- SHA256 c51a2bb51b3b9ffe496578f1ef5b9ae2cbace7a5c1c311c46c154f85f82fbdf3
- MD5 ff2ea33709e08311c1d1fbe0e1c698f6
- SHA1 d5cba9dec2f2225722417f1dced9e52dcbb8de49
- SHA512 365d08d7e1a01e9fd98f4e16b4ee79484572fdda5d128a6415121335ba309f00a1a15635fbf51b9dc8503e5e25ae9480b475ef03a20ddd5ca0f3a0fc0f9b341e
- SSDEEP 6144:CEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF9E:CMpASIcWYx2U6hAJQn2E
- TLSH T1EDA4BE147640D476E31A0B310416EAB04AA96C3A17D9E48FF7387E766E312D3977B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-07_ff2ea33709e08311c1d1fbe0e1c698f6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-11-07_ff2ea33709e08311c1d1fbe0e1c698f6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 456KB
- SHA256 c51a2bb51b3b9ffe496578f1ef5b9ae2cbace7a5c1c311c46c154f85f82fbdf3
- MD5 ff2ea33709e08311c1d1fbe0e1c698f6
- SHA1 d5cba9dec2f2225722417f1dced9e52dcbb8de49
- SHA512 365d08d7e1a01e9fd98f4e16b4ee79484572fdda5d128a6415121335ba309f00a1a15635fbf51b9dc8503e5e25ae9480b475ef03a20ddd5ca0f3a0fc0f9b341e
- SSDEEP 6144:CEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF9E:CMpASIcWYx2U6hAJQn2E
- TLSH T1EDA4BE147640D476E31A0B310416EAB04AA96C3A17D9E48FF7387E766E312D3977B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE